Privacy Policy

DRAFT for legal review — not yet in force. Data-protection obligations (for example UAE PDPL and EU GDPR where EU residents are served) must be confirmed by a lawyer before launch.

What we collect

• Account data: first and last name, username, recovery email address, password hash (we never store your password in readable form).
• Mail data: the messages, attachments, contacts and folders in your mailbox, stored on our mail server so we can provide the service.
• Security data: IP addresses and device information for sign-ins and registrations, kept to detect abuse and protect accounts.

How we use it

• To provide your mailbox and deliver your mail.
• To verify your identity, help you recover your account and send service notices.
• To filter spam and malware and to investigate abuse reports.

We do not sell your data and we do not scan your mail to show you advertising.

Automated processing

Incoming and outgoing mail is automatically checked by spam and malware filters. Staff do not read your mail except where required to investigate a specific abuse report or where required by law.

Sharing

We share data only with infrastructure providers that host the service (our server and backup providers), or when required by a valid legal order.

Retention

• Mail is kept until you delete it or delete your account.
• Sign-in logs are kept for 90 days.
• Backups are kept for up to 30 days, after which deleted data is gone from backups too.

Your rights

You can view and correct your name and recovery email in Settings, export your mail with any IMAP mail app, and delete your account at any time. Contact privacy@sender2.com for other requests.

Security

Passwords are hashed with Argon2id, all connections use TLS, and backups are encrypted.

Contact

privacy@sender2.com